Add user login/registration controller, and use this for oauth/authorize

* Add A1, A2 and ACL modules
* Add Login controller to handle user login and registration
* Override OAuth controller to require user be logged in before auth
* Handle auto redirecting user to login and back to oauth
* Update user model to add failed_attempts and last_attempt fields
* Make email field allow NULL
* Override OAuth2_Storage_ORM to use A1 auth
* Update tests to login during auth
Adding basic ACL wiring

* Add A2 and ACL submodules
* Define role privileges in config/a2.php
  In future these may be managed through the DB (& API).
* Add model for role
* Make roles-users relationship one to many, not many-to-many
* Define default guest, user and admin roles
* Define login/register/logout access via resources instead of checking
  for a logged in user
* Add API hooks for checking access via ACL
Fix tests to handle access control

* Make defaulttoken used by @oauthSkip use an admin user
Fix case on User model name in a1 config
Adding ACL tests and fixing issues during testing

* Add api.acl.feature
* Improve Ushahidi_Api::_check_access() to allow easier overriding of the
  resource being checked. This is so we can pass a Post object to
  acl assertions.
* Extend _check_access() in Posts to grab the requested post and check
  its access
* Override Acl_Assert_Argument to fix errors if resource fields are not
  defined.
* Update Acl_Assert_ArgumentStatic to fix similar errors
* Update a2 config to fix GuestCanCreatePost rule and reformat
* Update posts tests to keep them working
Filter /posts collection based on user allowed access

* Only include posts if access check passes
* Add extra draft posts for testing
* Add tests for admin and user seeing private posts in collection
Add status filter to /posts and filter by published by default

* Rename test attribute status to missing_status to avoid conflict
* Add status=all filter to acl tests
* Add status filter code in posts controller
Fix oauth test "Authorized Posts Request"

* Make testingtoken have admin access since test requires posts
  PUT access
Add test to ensure anonymous users can access individual public posts
Standardizing protected/private variable naming
Refactor GET and PUT /posts/:id to share post loading code

* We use this to simplify run the access checks against that post too.
* Load post using resource() with actual work done in _resource()
* Override _resource for special loading behaviour
Move OAuth2 scopes and realm name to config file
Add ACL rules for sets and tags, and add access checks too

* Override _resource() for Sets and Posts controllers
* Allow users to create sets
* Allow users to edit own sets
* Allow users to view sets and tags
Remove unneeded 2nd values() call in sets and tags api
Add access checks to Forms api

* Override _resource() and centralise loading the
  form for get/put/post/delete requests
* Implemente resource interface in Form model
Share code between Form create and update.
Reduce duplication of groups/attributes handling in Forms API

Keep group and attribute objects after validation and the loop through
them to save. Previously object were discarded after validation
and recreated to save leaving room for errors and mismatches in values
set.
Allow reusing existing attributes during form creation.
API forms/:id/group/:id/attributes - forward attribute creation to /attributes api

Use HMVC to pass request on to /attributes API
Refactor Groups and Attributes API to share code between PUT and POST request